AP

• Every figure is produced by a single named metric definition, so two surfaces cannot report different numbers for the same business question.
• A viewer sees only what their role and organisational scope permit.
• A figure someone is not entitled to see is absent, not zeroed. A zero is a claim about the business, and showing one where the real answer is “not permitted” is a lie the reader cannot detect.

• A leader sees their entire authorised downline, at any depth, and can drill from a leader into a leader into an agent.
• They see nothing outside it — not in a list, not in a search result, and not by guessing an identifier.
• Reach is a property of the record’s position in the hierarchy, never of a value the caller supplies.

• Roll-ups resolve through the same metric layer as every other figure on the platform.
• Performance is readable at each level of the ladder without exposing anything outside the viewer’s subtree.

• Exceptions deduplicate by condition and carry occurrence counts, so one recurring problem is one row.
• Where AI resolved something, that is tracked and attributable.

• Dashboards are composed per request from the viewer’s role, organisational scope and licensed modules.
• A metric belonging to a module you have not licensed reports an explicit no-data state rather than a zero value.

• Stage transitions are validated by the server, not by the screen.
• Gates — documents, licence, mandatory training, assessment, contract, background check — are individually configurable as enabled and as blocking.
• A blocking gate genuinely blocks. A candidate cannot be activated past one.

• Gates are evaluated at the moment activation is attempted, not at the moment they were last checked.
• Activation raises a business event other systems can subscribe to.

• Expiry is anticipated rather than discovered: an approaching expiry raises notifications, with escalation.
• Licence status affects what the agent may do, and that is enforced server-side rather than by hiding a button.

• Overdue mandatory training is surfaced to the agent and to their leader.
• Approving training content is the single act that makes material both learnable by a person and answerable-from by AI.
• Superseded documents cannot be cited. A withdrawn product sheet stops being an answer the moment it is withdrawn.

• A neglected lead is surfaced as an exception rather than left to rot.
• Conversion produces a customer or prospect the rest of the selling journey can act on.

• Composition happens per request and is filtered by permission.
• A section the viewer may not see is withheld visibly: they are told a section exists and is not shown to them, rather than being handed a view that silently pretends to be complete.

• Comparison uses only approved structured data.
• Where a product has no comparable value, the absence is rendered as an absence. Filling it with a plausible figure would be the most damaging defect this kind of product can have.

• Pricing comes from a quotation provider — your rating engine in a real deployment.
• The origin of every figure is unmistakable on screen. A development figure is never dressed up as an insurer’s rate.

AP does not price. It presents what the rating engine returned.

• The server is authoritative on every state transition.
• Required documents are enforced at submission, not suggested.
• Approve, decline and request-more-information are made by a human holding the decision permission, and recorded durably with actor, time, subject and reason.

AI never makes the decision. It prepares the case; a person decides it.

• Policies are read from the system of record through a canonical contract.
• Where the data is stale or the source is unreachable, that is shown. It is never hidden behind a plausible empty result.

AP does not become a second source of policy truth.

• At-risk renewals surface ahead of the event, to the agent who can act and the leader who can coach.

• The module boundary, permissions and integration contract exist. The implementation is scoped and built during an engagement, against your claims system.
• AI may explain what a claim requires. It may not decide one.

AP does not adjudicate claims.

• Your system calculates. AP reconciles what it receives, surfaces discrepancies, and explains them in terms an agent can act on.
• A discrepancy is raised, never silently corrected.

AP is not the authoritative commission calculation engine, and does not attempt to become one.

• Every attempt is recorded with its outcome, and where a message was suppressed, the reason.
• A channel with no configured adapter records that it could not send. It does not silently succeed.

• The channel abstraction and delivery log are built. The provider adapters are configured during an engagement, against the gateways you already hold contracts with.
• Until an adapter is configured, the delivery log records that the channel could not send — which is the honest state, and a visible one.

• Every agent declares the tools it may call, the permission each tool requires, and the level of autonomy it is allowed.
• Tools are bound to the caller’s permissions and evaluated by the same authorisation engine as the rest of the product.
• Prompt content is not a security boundary, and AP does not treat it as one.

• A question the approved corpus does not cover is refused, with a machine-readable reason rather than a sentence somebody has to parse.
• A refusal is rendered as a refusal. It is not softened into a plausible guess.

AP does not give free-form insurance advice. It answers from what the insurer approved, or it declines.

• The pending action is stored with an expiry, and nobody can approve their own.
• Approvals are audited like every other consequential decision.

AI makes no regulated decision. That is enforced, not promised.

• Governance is a running control surface, not a policy document filed somewhere.
• A residency gate refuses egress of regulated data to a provider your configuration does not permit.

• AP ships with a deterministic provider that needs no credentials and sends nothing anywhere — so the full AI product runs with no external model at all.
• A hosted provider adapter is implemented and available. Other providers — OpenAI-compatible, Azure OpenAI, Bedrock, Vertex, or a private model you host — are declared boundaries whose adapters are built and certified during an engagement.

Xcelerates does not claim a provider is supported before it has passed the conformance suite.

• The contracts this rests on are defined and verified against the platform capabilities beneath them. No mobile application exists.
• By design, the device would never talk to a model provider directly: every call goes through AP, so your approved provider and residency policy apply on a phone exactly as on a desktop.

There is no shipped mobile application today. This is a roadmap item.

• Recording would never be assumed. Consent would be an auditable record — wording, participants, method, time — not a checkbox.
• Guidance would be explicitly marked agent-only or customer-shareable, and nothing would be written to a system of record until a human confirmed it.
• Today this exists as a contract and a consent model. It is not built.

No always-on listening, and no uncontrolled recording. Those are design constraints, not features to be added later.

• Fourteen canonical provider contracts cover the domains AP reads and writes across.
• Adapters resolve those contracts per domain and per deployment, so two domains can come from two different systems.
• Staleness and failure are surfaced, never hidden behind a plausible empty result.

• An unlicensed module is invisible in navigation and refused by the API. Hiding a menu is not access control.
• The licence is signed and verified offline, with no callback and no network dependency, because an air-gapped deployment has to be a supported one.
• Licence expiry degrades. It never destroys or withholds your own business data.

• Authorisation scope is read from the record the operation concerns, never from a value the caller supplied.
• A second decision site is how an authorisation model drifts, so there is exactly one.

• Decisions carry actor, time, subject and reason.
• Denied attempts are audited, not discarded — the absence of a record of refusal is itself a gap.

• AP is defined as a technology-neutral product blueprint with a certified reference implementation, so the product is not the same thing as the stack it currently runs on.
• Alternative enterprise technologies are assessed and certified against a conformance suite rather than asserted.

A technology is supported when it has passed the conformance suite — not when the architecture could accommodate it.